[jaclynjessup]

Snyk has created this PR to fix 1 vulnerabilities in the yarn dependencies of this project.

Snyk changed the following file(s):

• modules/codemod/package.json

Note for zero-installs users

If you are using the Yarn feature zero-installs that was introduced in Yarn V2, note that this PR does not update the .yarn/cache/ directory meaning this code cannot be pulled and immediately developed on as one would expect for a zero-install project - you will need to run yarn to update the contents of the ./yarn/cache directory.
If you are not using zero-install you can ignore this as your flow should likely be unchanged.

⚠️ Warning

Failed to update the yarn.lock, please update manually before merging.

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Regular Expression Denial of Service (ReDoS) SNYK-JS-PICOMATCH-21248802	721

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)

[jaclynjessup]

This is a significant major version upgrade from 0.14.0 to 17.4.0, introducing several critical breaking changes. The version jump from v0.x to v17 was an intentional decision to mark a major release after a long period of minor versions, similar to React's jump from v0.14 to v15.

Key Breaking Changes:

• Node.js Version Requirement: The minimum required version of Node.js is now 16. Environments running older versions of Node.js will need to be upgraded.
• Internal Parser and Dependency Overhaul: The new version includes major updates to internal dependencies, most notably the recast AST parser. Transforms written for v0.14.0 are not guaranteed to work, as the underlying AST structure and query APIs may have changed. Existing codemod scripts must be re-validated.
• Potential Default Parser Change: There have been significant changes to the parsing engine to support modern JavaScript features. Older transforms may have implicitly relied on the behavior of the previous default parser, which was compatible with Babel 5.

Recommendation:
This upgrade is high-risk due to the required Node.js update and fundamental changes to the AST parsing engine. All existing jscodeshift transforms must be thoroughly tested and likely updated to be compatible with the new API and AST structure before this upgrade can be merged.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[coderabbitai]

Important

Review skipped

Ignore keyword(s) in the title.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Workday/canvas-kit
• Branch: snyk-fix-5d5dafda0a9788c726f45da9e2cde64f
• File: .coderabbit.yaml
• Commit: 53f7ec8
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 350efb53-9212-4868-b7f8-8c60d2798bac

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cypress]

Workday/canvas-kit    Run #11783

Run Properties:   Passed #11783  •  1d9aa9d1f5 ℹ️: Merge 53f7ec81ac964ed69ac27f48facbf924620825bb into 0e25056a224a4eb0810fcb7cb7e2...

Project	Workday/canvas-kit
Branch Review	snyk-fix-5d5dafda0a9788c726f45da9e2cde64f
Run status	Passed #11783
Run duration	02m 45s
Commit	1d9aa9d1f5 ℹ️: Merge 53f7ec81ac964ed69ac27f48facbf924620825bb into 0e25056a224a4eb0810fcb7cb7e2...
Committer	Jaclyn
View all properties for this run ↗︎

---

Test results
Failures	0
Flaky	0
Pending	17
Skipped	0
Passing	915
View all changes introduced in this branch ↗︎

UI Coverage  14.36%
Untested elements	2557
Tested elements	426

Accessibility  99.22%
Failed rules	4 critical   5 serious   3 moderate   2 minor
Failed elements	75